Domain Consolidation — Current State

Scope: Map every AD forest, DNS zone, and domain registrar in the Cirius Group estate as of April 2026 Purpose: Pre-work for the Dashboard consolidation and broader identity simplification Related story: DASHCF-009 Companion: architecture/domain-consolidation-target-state.md

---

Why Document This Now

Cirius Group runs three distinct Active Directory forests plus multiple DNS zones across multiple registrars. The Dashboard migration (DashboardVM20 Central → West) and the kill-chain detection work both depend on understanding where each identity and each name lives. Consolidation cannot start without a complete current-state map.

---

Active Directory Forests

Forest / Domain	Tenant / Location	Purpose	Domain Controllers	Trust Relationships
ciriusgroup.com	Entra PROD (tenant d477c9f8) + on-prem AD	Primary production identity — employees, production workloads	ACTRODC01 (primary DC), other PROD DCs	Syncs to Entra PROD via Entra Connect (from PROD)
ciriusdde.com	Entra DDE (tenant ff1c5d68) + Azure-hosted DCs	Customer-facing Medicare billing environment; AVD identity plane	ACTDIRAZC01, ACTDIRAZC02 in DDE Azure	Syncs to Entra DDE via ENTRACAZC01
dr.ciriusgroup.internal	On-prem AD (DR site)	Disaster recovery domain; not internet-resolvable	DR-site DCs	No Entra sync; isolated DR forest

Key observations:

• Three separate identity planes, each with its own break-glass account (cirius-breakglass@ciriusgroup.com, cirius-breakglass@ciriusdde.com, cirius-breakglass@dr.ciriusgroup.internal).
• ciriusgroup.com and ciriusdde.com are intentionally isolated tenants — DDE is regulated separately for HIPAA and cannot share the PROD identity plane.
• dr.ciriusgroup.internal is non-routable on the public internet and exists purely for DR site operations.
• No Active Directory trust between ciriusgroup.com and ciriusdde.com; they communicate exclusively through published applications and managed service principals.

---

DNS Zones and Registrars

Domain	AD Forest	DNS Zone Location	Registrar	Purpose
ciriusgroup.com	ciriusgroup.com	Azure DNS (PROD subscription)	U2 Web	Primary corporate domain — email, SSO, public web presence
ciriusdde.com	ciriusdde.com	Azure DNS (DDE subscription)	U2 Web	Customer-facing DDE AVD and Medicare billing endpoints
ciriusgroup.internal (split-horizon)	n/a (DNS only)	On-prem AD DNS + Azure Private DNS	n/a (internal)	Internal-only names; not registered publicly
dr.ciriusgroup.internal	dr.ciriusgroup.internal	On-prem DNS (DR site)	n/a (internal)	DR domain; on-prem resolution only
secops.bedrockcybersecurity.org	n/a (sub-zone in Azure DNS)	Azure DNS (logging subscription)	Inherits from ciriusgroup.com	SecOps platform (FastAPI Container App)
Dashboard FQDNs (current)	n/a	Azure DNS or Cloudflare (migration pending)	U2 Web	DashboardVM20 in US Central, migrating to US West

Registrar: U2 Web is the registrar of record for every public-registered domain in the estate. Internal-only zones (.internal) are not registered with any public registrar.

DNS hosting: Azure DNS hosts the authoritative zones for the public domains. No external DNS-hosting-as-a-service (e.g., Cloudflare DNS) is currently authoritative for the apex of any Cirius domain — the Dashboard Cloudflare work may change that selectively for sub-zones.

---

Forest-to-Tenant Mapping

On-prem AD Forest	Entra Tenant	Sync Path
ciriusgroup.com	ciriusgroup.com (d477c9f8)	Entra Connect from PROD on-prem → Entra PROD
ciriusdde.com	ciriusdde.com (ff1c5d68)	ENTRACAZC01 (Entra Connect server in DDE) → Entra DDE
dr.ciriusgroup.internal	None	Intentionally not synced — DR isolation

---

Application Auth Dependencies (Why Consolidation Is Hard)

Consolidation cannot happen by fiat because several applications and integrations bind to specific domain names or UPN suffixes:

• DDE AVD sessions authenticate users at *@ciriusdde.com UPNs. Customers and operators are provisioned specifically in the DDE tenant; renaming the domain breaks every active session and every federated relationship.
• Entra Connect on ENTRACAZC01 is bound to the ciriusdde.com UPN suffix.
• Published Medicare billing app has allowlists referencing ciriusdde.com sender/reply-to addresses and SPF/DKIM/DMARC published against that domain.
• SecOps platform SSO and federated credentials reference ciriusgroup.com tenant.
• GitHub OIDC uses Cirius-Group-Inc org name (exact, case-sensitive) — separate from domain naming but worth noting in any renaming workstream.
• Certificates on Palo Alto firewalls, Twingate connectors, and published apps reference specific FQDNs; a domain rename means a coordinated cert refresh.

---

Legacy / Decommission Candidates

During current-state mapping, look for:

• Abandoned DNS zones (domains registered but no active records or traffic) — keep only if Rory confirms strategic value.
• Old UPN suffixes configured on ciriusgroup.com that are no longer used.
• Stale DNS records pointing to decommissioned VMs (common after Dashboard and other migrations).
• Legacy AD objects (computer accounts for VMs that were retired) in any of the three forests.

These are findings for the target-state plan, not in-scope changes for the current-state doc itself.

---

Source Systems for This Inventory

When refreshing this document, pull from:

• az network dns zone list across PROD and DDE subscriptions for authoritative DNS zones.
• U2 Web registrar console for registered domain list and renewal dates.
• Get-ADForest / Get-ADDomain on each DC (PROD, DDE, DR).
• Entra portal: Custom domain names for each tenant.
• Entra Connect config on ENTRACAZC01 for synced UPN suffixes.
• azure-infra/identity/ Terraform for the source-of-truth configuration of Entra-side objects.

---

Next

See architecture/domain-consolidation-target-state.md for the proposed target state, phased migration sequence, and dependencies.

---

Related

• architecture/domain-consolidation-target-state.md — target architecture
• SecOps project DASHCF — Dashboard Migration & Cloudflare epic
• azure-infra/identity/ — Terraform source of truth for Entra PROD identity